fix(core-realtime): address Phase 2 code review (typing, error handling, params)

- Type socket.data.user via AppSocketData/AppSocket generics (no more any)
- Wrap Gate 1 authenticator call in try/catch so exceptions reject the
  connection with connect_error instead of being swallowed
- Fix Gate 3 userScoped channel authorize: derive params.userId from the
  authenticated socket user so owner-inbound is accepted
- Await io.close(callback) in stop() to ensure full shutdown
- Remove unused httpServer field from constructor (io already holds the ref)
- Extract CHANNEL_ROOM_PREFIX/channelRoom helper to channel-room.ts;
  replace three `ch:${name}` magic strings; re-export from index
- Add JSDoc to ChannelScope explaining userScoped params/template convention
- Fix "allows subscribe + invokes handler with ctx" test: hoist received
  outside beforeEach and assert ctx shape
- New test: rejects connection when authenticator throws
- New test: userScoped channel accepts inbound from owner, rejects from anon

packages/core-realtime/src/index.ts

@@ -1,5 +1,6 @@
 export type { ChannelScope, RealtimeChannelDescriptor } from "./realtime-channel";
 export { defineRealtimeChannel } from "./realtime-channel";
+export { CHANNEL_ROOM_PREFIX, channelRoom } from "./channel-room";
 export type { IRealtimeBroadcaster } from "./realtime-broadcaster.interface";
 export type { IRealtimeHandler, IInboundDescriptor, RealtimeContext } from "./realtime-handler.interface";
 export type { IRealtimeServer, IRealtimeServerOptions } from "./realtime-server.interface";